CVE-2026-86320: Flatpak-Builder RCE Vulnerability

CVE-2026-86320 Overview

CVE-2026-86320 is an arbitrary code execution flaw in flatpak-builder, the tool used to build Flatpak application bundles from manifests. The vulnerability occurs when patch sources are applied with the use-git-am: true option. In this mode, flatpak-builder does not disable Git hooks, allowing a malicious source repository containing a Git post-applypatch hook to execute code on the build host. Successful exploitation yields arbitrary code execution with the privileges of the user running flatpak-builder. The issue is classified under CWE-94 (Improper Control of Generation of Code).

Critical Impact
A malicious source repository can execute arbitrary commands on the builder host during a routine flatpak-builder invocation, compromising developer workstations and CI/CD build agents.

Affected Products

flatpak-builder (upstream project)
Red Hat distributions shipping flatpak-builder (see Red Hat CVE-2026-86320)
Build environments and CI pipelines consuming untrusted Flatpak manifests

Discovery Timeline

2026-09-17 - CVE-2026-86320 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-86320

Vulnerability Analysis

flatpak-builder supports applying source patches through git am when a manifest sets use-git-am: true on a patch source. During this operation, Git invokes repository hooks such as post-applypatch if they are present in the patched repository. The builder fails to disable or sandbox these hooks. An attacker who controls a source referenced by a manifest can plant an executable post-applypatch script inside .git/hooks/. When the build runs, Git executes that script on the host with the identity of the invoking user.

This is a local attack vector requiring user interaction, since a developer or automated pipeline must invoke flatpak-builder against the malicious manifest or source. Impact on confidentiality, integrity, and availability is high because the executed hook runs unrestricted outside the Flatpak sandbox. Distribution build farms and shared CI runners are particularly exposed, since a single poisoned manifest can pivot into the wider build infrastructure.

Root Cause

The root cause is missing hardening around Git subprocess invocation. flatpak-builder does not set environment variables such as GIT_CONFIG_COUNT with core.hooksPath=/dev/null or pass -c core.hooksPath= when calling git am, so hooks stored under the source repository run by default.

Attack Vector

Exploitation requires an attacker to supply a source archive or Git repository that contains a post-applypatch hook, and a Flatpak manifest that references that source with use-git-am: true. When a victim executes flatpak-builder against the manifest, the hook runs as part of the patch step. Refer to the GitHub Security Advisory GHSA-j5p8-jgjc-f3xv for the upstream technical description. No verified public exploit code is available at the time of writing.

Detection Methods for CVE-2026-86320

Indicators of Compromise

Presence of executable files under .git/hooks/ such as post-applypatch, post-checkout, or post-merge in sources fetched by flatpak-builder.
Unexpected child processes spawned by git under a flatpak-builder build tree, especially shells, interpreters, or network utilities.
Outbound network connections from build hosts during the patch-application phase of a Flatpak build.

Detection Strategies

Scan Flatpak manifests for use-git-am: true and audit the associated source repositories for hook scripts prior to building.
Instrument build hosts to record process ancestry, flagging any process whose parent chain includes git-am and whose executable resides in a repository hooks directory.
Compare fetched source trees against upstream hashes to identify tampered repositories.

Monitoring Recommendations

Forward process execution and file creation telemetry from developer workstations and CI runners to a centralized analytics platform.
Alert on writes to .git/hooks/ paths within transient build directories.
Track invocations of flatpak-builder and correlate with subsequent process, file, and network activity for anomaly review.

How to Mitigate CVE-2026-86320

Immediate Actions Required

Upgrade flatpak-builder to the fixed version published in the GitHub Security Advisory GHSA-j5p8-jgjc-f3xv as soon as vendor packages become available.
Audit all manifests in build pipelines for use-git-am: true and validate the trust level of the referenced sources.
Isolate flatpak-builder execution in ephemeral, non-privileged build containers to limit blast radius.

Patch Information

Refer to the upstream advisory at GitHub Security Advisory GHSA-j5p8-jgjc-f3xv and the distribution tracker at Red Hat CVE-2026-86320 for fixed package versions and errata. Additional context is available in Red Hat Bug Report #2471023.

Workarounds

Remove or replace use-git-am: true in Flatpak manifests, using standard patch application instead where feasible.
Set core.hooksPath to an empty or non-existent directory in the build environment so Git ignores repository-provided hooks.
Run flatpak-builder under a dedicated unprivileged user inside a disposable sandbox such as a rootless container or a minimal VM.

bash

# Neutralize Git hooks globally for the build user before invoking flatpak-builder
git config --global core.hooksPath /var/empty

# Or set per-invocation via environment override
GIT_CONFIG_COUNT=1 \
GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/var/empty \
flatpak-builder build-dir manifest.yaml